Skip to content
Fencer Vulns
high 7.1

CVE-2026-112188 json

MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution

published 2026-10-19 21 d ago modified 2026-10-28 11 d ago also EUVD-2026-104150

cvss
7.1
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.

The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.

A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.

The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.

Affected versions: <2.5.48.

Patch / fix

  • MISP MISP 2.5.48

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
11 d ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA 4.0 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • MISP MISP

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-285 Improper Authorization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.